agents-shipgate

Overview

Agents Shipgate acts as a static, local-first merge gate and control loop designed specifically for AI coding agents and repositories utilizing agent tools, MCP exports, OpenAPI specs, and SDK artifacts. It evaluates capability changes, checks trust roots, and produces deterministic findings, Markdown reports, JSON outputs, and SARIF files. By relying on strict cryptographic control envelopes and verification receipts, it prevents unauthorized privilege escalation or bypass of security controls during agentic development workflows.

Capabilities

• ▸Deterministic static analysis of AI agent tools and capability configurations
• ▸Support for multi-framework inputs including MCP, OpenAPI, LangChain, CrewAI, and Google ADK
• ▸Structured JSON and SARIF security reporting
• ▸Rigorous control state machine for coding agents (checking permissions, next actions, and merge authority)
• ▸Automated workspace bootstrapping and patch application for first-time adopters

Best for

Gating AI-generated pull requests and agent capability changes in CI/CD pipelines, Auditing MCP servers, OpenAPI specs, and agent SDK configurations for security compliance, Running local control loops before coding agents mark tasks as complete, Generating static analysis reports for AI tool definitions across LangChain, CrewAI, and OpenAI Agents SDK

Works with

Security considerations

The skill enforces strict static analysis with zero network access or agent execution during scans. It prevents tampering by validating cryptographic receipts and tying control states directly to workspace HEAD and tree states.

Categories